Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/15/2013
08:00 AM
Venky Ganesan
Venky Ganesan
Commentary
100%
0%

Secure Your Network From Modern Hazards

Traditional security measures don't stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Information security discussions have moved from wiring closets to corporate boardrooms. In early 2012, Bloomberg Government and the Ponemon Institute issued a study that showed 172 US-based organizations -- from multinational corporations to the federal government -- spend a combined $5.3 billion on cybersecurity.

These institutions estimated they will have to spend $46.6 billion to adequately address today's attacks -- from state-sponsored campaigns to rogue activism that threaten data and the nation's critical infrastructure. Our systems have become so tied to the Internet, this "grid" can be compromised with a single swipe. The threat is real, relevant, and happening right now.

It appears 2013 will be remembered as the year when the avalanche of data -- from social media and enterprise big data -- collided head on with our ability to maintain the security and privacy of that data. The data generated by individuals, corporations, and government organizations is exploding and can neither be contained nor controlled. Chief information security officers (CISOs) and IT professionals, as the stewards of that data, with conventional approaches are bringing a sword to a gunfight.

[ Here's how to make your network more bulletproof. Read Can Your Network Beat Malware? ]

The world has become fluid. There are few enforceable boundaries between the corporate and the personal, the local and the remote, the datacenter and the cloud. According to Cisco's Global Mobile Data Traffic Forecast, by the end of this year, "the number of mobile-connected devices will exceed the number of people on Earth." Data is being consumed and produced across billions of devices scattered across ad-hoc network connections and crossing boundaries without pause. There's no perimeter in the cloud and the tools we have no longer work.

As a venture capitalist actively investing in the security market, I see three critical issues and related opportunities for information security pros:

1. Walled gardens have become wild gardens
CISOs are losing the security arms race. Even highly secure organizations -- including the security companies themselves -- have been breached. The reason is simple: the security model traditionally applied no longer matches the real world. Systems fail because of an attempt to control and contain by drawing boundaries, while data, users, and devices are becoming dynamic and mobile. Data has become liquid. Location-centric, device-centric, port-centric tools are simply inadequate to the task.

Security architecture has to become both dynamic and adaptive. Security tools will become more automated, using machine learning and big data analytics to respond to attacks. This will be done in a more fluid manner, focused on the data and the applications themselves and less on the port and the device. CISOs need to re-architect their security paradigm and invest in data-centric approaches such as DNSSEC, AES encryption, and TLS/SSL, and assume their perimeter has been compromised.

2. BYOD = BLOT
Organizations tolerate a "bring your own device" policy, but it actually "brings lots of trouble." Intellectual property leaks are multiplying. The reason? Security is focused on the containers rather than the data itself. Mobile security is mostly about device management. Datacenters and operating systems protect their perimeter with network and file-access controls. This containment model is failing because the data is moving too fast between devices and users. Even the NSA fell victim with an internal, human-led compromise. Mobile device makers are rushing to add containment controls, such as fingerprint scanners, but there is still inadequate focus on the data itself.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/15/2013 | 12:32:47 PM
Encryption
Your comment "one way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system." makes a huge amount of sense. However, actual use of encryption is in the single-digits in many surveys. Best case, databases at rest are encrypted. End user devices? Forget it. The usual excuse is key management -- that  these systems are still too complex and expensive.

What's your advice to IT pros who want to expand encryption but are running scared of losing keys?
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/15/2013 | 12:33:44 PM
Security evolution
I agree that security needs to focus on the data, rather than the devices, systems and locations where we keep it. Those other elements are changing so quickly we can't possibly keep up. Another transition for security pros is to learn how to respond and recover after a breach or attack, and to put as much effort into that as into prevention. If your company is singled out and targeted, the best you may be able to do is cut your losses.
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/15/2013 | 4:37:36 PM
The Perimeter is Less Important
I think your general approach is right.  We can't ignore the perimeter, but defending it is no longer the be all and end all of security.  What's required is constant, real-time (and therefore automated) monitoring of data within the perimeter.
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
11/17/2013 | 10:17:27 PM
Re: Encryption
@Lorna, very good question - in my opinion the data encryption is always a kind of paradox. Without encryption, the data will not be secure and you are exposed to security breach. If you try to encrypt everything, then what about if you lose your encryption key? The modern key management mechanism helped to give some relief on this issue. But the problem is not completly solved - there is still the trouble to renew the certificate in case it's lost. Another more severe question is that, how can we fully trust the root CA itself?
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:16:19 AM
Re: Encryption
Lorna - you are right! Encryption currently has very low usage - key management is an issue so is latency and performance.  However there are solutions emerging that address all elements of this.  The security discussion is now in the boardroom and the downside of data leakage is so high that I believe top down mandates are coming to push encryption to the data level.  We will see.

Venky
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:18:45 AM
Re: Encryption
There are distributed key management solutions coming along so you are not dependent on a root key.  True security woudl require you not to be exposed to a single point of failure with a root key.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/19/2013 | 8:36:43 AM
Re: Encryption
I hope so. We plan to run a survey on encryption use in Q1, and trend it back to one we did in 2011. I will be very interested to see movement. What are some of the companies that you find interesting?
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Hunny, I looked every where for the dorritos. 
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8567
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVE-2020-8568
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...
CVE-2020-8569
PUBLISHED: 2021-01-21
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, ...
CVE-2020-8570
PUBLISHED: 2021-01-21
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executi...
CVE-2020-8554
PUBLISHED: 2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typicall...